BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

49 BIOCs match the current filters. tactic: TA0006 ✕

Download CSV Show ATT&CK heatmap
  • Cleartext password harvesting using find tools Informational Credential Access

    On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.

    Indicator:

    Process action type = execution AND target process name = find.exe , findstr.exe AND target process cmd = *password*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Command-line arguments match Mimikatz execution High Credential Access

    These command-line arguments are often used by Mimikatz to dump credentials.

    Indicator:

    Process action type = execution AND target process cmd = *privilege::debug* , *sekurlsa* , *kerberos::tgt* , *logonpasswords* , *kerberos::ptt* , *kerberos::golden* , *kerberos::list*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Creation of volume shadow copy using vssadmin.exe Informational Credential Access

    An attacker may create volume shadow copies to gain access to protected or locked files, whereas backup is the common legitimate use.

    Indicator:

    Process action type = execution AND target process cmd = * create* shadow* AND target process name = vssadmin.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential Vault command-line access Medium Credential Access

    The Credential Vault command line was used to enumerate a user's saved credentials.

    Indicator:

    Process action type = execution AND target process cmd = * /list* AND target process name = vaultcmd.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via LaZagne High Credential Access

    LaZagne has been executed. Attackers may use this tool to gather account and password information from credential dumping.

    Indicator:

    Process action type = execution AND target process cmd = *LaZagne.py* Host host os = linux , macos , windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Credential dumping via fgdump.exe Medium Credential Access

    Attackers may use fgdump.exe to perform local credential dumping.

    Indicator:

    Process action type = execution AND target process name = fgdump.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via gsecdump.exe Medium Credential Access

    Attackers may use gsecdump to obtain password hashes and LSA secrets.

    Indicator:

    Process action type = execution AND target process name = gsecdump.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via pwdumpx.exe Medium Credential Access

    Attackers may use pwdumpx.exe to perform local or remote credential dumping.

    Indicator:

    Process action type = execution AND target process name = pwdumpx.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) OS Credential Dumping: Security Account Manager (T1003.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via wce.exe Medium Credential Access

    Attackers may use wce.exe (Windows Credential Editor) to obtain user credentials.

    Indicator:

    Process action type = execution AND target process name = wce.exe , wce32.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credentials from Web Browsers Informational Credential Access

    Detects attempt to copy browser files to acquire credentials.

    Indicator:

    Process action type = execution AND target process cmd =~ .*[/]Application Support[/](Island|Google)([/]Chrome[/]Default|[/]Chrome[/]User Data[/]Default)?[/].*Login Data.* AND target process name = cp

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Dumping Registry hives with passwords Low Credential Access

    Dumping registry hives can be used to obtain stored credentials/hashes.

    Indicator:

    Process action type = execution AND target process cmd = * save *HKLM\sam* , * save *HKLM\security* , * save *HKLM\system* , * save *HKEY_LOCAL_MACHINE\sam* , * save *HKEY_LOCAL_MACHINE\security* , * save *HKEY_LOCAL_MACHINE\system* Process initiated by != ir_agent.exe AND cgo name != ir_agent.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Dumping lsass.exe memory for credential extraction Medium Credential Access

    Dumping lsass.exe memory to a file allows attackers to later extract credentials from the dumped memory.

    Indicator:

    Process action type = execution AND target process name = procdump.exe , procdump64.exe AND target process cmd = *lsass*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of Fsociety tool pack Medium Discovery

    The Fsociety tool pack is an array of tools for information gathering, password attacks, exploitation, and more.

    Indicator:

    Process action type = execution AND target process cmd = *fsociety.py* , target process name = fsociety Host host os = linux

    ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)
    ATT&CK techniques: Network Service Discovery (T1046) Brute Force (T1110)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Forensics Driver Loaded Informational Collection XQL

    A forensics driver has been loaded.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE_PRELOAD","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_vendor","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_product","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: Automated Collection (T1119) OS Credential Dumping (T1003)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • GUI Input Capture Informational Credential Access

    Prompt user to supply a password in response to a System Preference dialog pop up message.

    Indicator:

    Process action type = execution AND target process cmd =~ .*-e[[:blank:]]+tell app \"System Preferences\" to activate.*tell app \"System Preferences\" to display dialog.*[[:blank:]]+return.*answer.* AND target process name = osascript

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Input Capture: GUI Input Capture (T1056.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Grepping for passwords Informational Credential Access

    Attackers may look for cleartext passwords in files using the grep command.

    Indicator:

    Process action type = execution AND target process cmd = *pass* AND target process name = grep

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Hash cracking using Hashcat tool Medium Credential Access

    Hash cracking allows attackers to collect passwords and use them later on as part of their operation.

    Indicator:

    Process action type = execution AND target process cmd = * -m* , * --hash-type* , * -a* , * --attack-mode* , *.txt* AND target process name = hashcat*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Installation of Cain & Abel password recovery tool Low Credential Access

    A process created a Registry key associated with the common password cracking tool Cain & Abel.

    Indicator:

    Registry action type = set_registry_value , create_registry_key AND registry key name = *\software\cain* Host host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Internet Explorer home page modification Low Tampering

    The Internet Explorer home page could be changed to a malicious page.

    Indicator:

    Registry action type = all AND registry key name = *\Software\Microsoft\Internet Explorer\Main\* AND registry value name = *Start Page* Process initiated by != iexplore.exe AND cgo name != iexplore.exe Host host os = windows

    ATT&CK tactics: Impact (TA0040) Credential Access (TA0006)
    ATT&CK techniques: Defacement (T1491) Input Capture: GUI Input Capture (T1056.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kerberos brute-force attack using Kerbrute Informational Credential Access

    This is a known Kerbrute tool command, used to conduct Kerberos authentication brute-force attacks.

    Indicator:

    Process action type = execution AND target process cmd = *kerbrute* -domain * -users * -passwords * , *kerbrute* -domain * -passwords * -users * , *kerbrute* -users * -domain * -passwords * , *kerbrute* -users * -passwords * -domain * , *kerbrute* -passwords * -users * -domain * , *kerbrute* -passwords * -domain * -users * , *passwordspray * , *bruteforce * , *bruteuser *

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Brute Force (T1110)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kerberos service ticket request in PowerShell command High Credential Access

    Asking for a specific Kerberos service ticket can indicate an attacker's attempt to "Kerberoast" or use the ticket directly.

    Indicator:

    Process action type = execution AND target process cmd = * KerberosRequestorSecurityToken* , *Invoke-Kerberoast*

    ATT&CK tactics: Credential Access (TA0006) Lateral Movement (TA0008)
    ATT&CK techniques: Use Alternate Authentication Material: Pass the Ticket (T1550.003) Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Key Certificate Search And Exfiltrate Informational Credential Access

    Possible attempt to search for key certificates and exfiltrate them.

    Indicator:

    Process action type = execution AND target process cmd =~ .*(id_rsa|[.]key|[.]pgp|[.]gpg|[.]ppk|[.]p12|[.]pem|[.]pfx|[.]cer|[.]p7b|[.]asc).*-exec[[:blank:]]+cp[[:blank:]]+.* AND target process name = find

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Keychain Certificate Access Informational Credential Access

    Detected access to Keychain certificates.

    Indicator:

    Process action type = execution AND target process cmd =~ .*find-certificate.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Keychain Import Item Informational Credential Access

    An item was imported from the Keychain.

    Indicator:

    Process action type = execution AND target process cmd =~ .*import.*[.]pem.*(-k)?.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Keychain Unlock Informational Credential Access

    Detected Keychain unlocking.

    Indicator:

    Process action type = execution AND target process cmd =~ .*unlock-keychain.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Securityd Memory (T1555.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • LOLBAS reading a Windows credential manager file Informational Credential Access

    Encrypted files under the path AppData\Roaming\Microsoft\Credentials are associated with saved passwords in the Windows system.

    Indicator:

    File file path = *\appdata\roaming\microsoft\credentials\* AND action type = read Process initiated by = regsvcs.exe , schtasks.exe , xwizard.exe , findstr.exe , esentutl.exe , reg.exe , csc.exe , atbroker.exe , print.exe , pcwrun.exe , rpcping.exe , wsreset.exe , replace.exe , mshta.exe , bitsadmin.exe , ieexec.exe , cmd.exe , microsoft.workflow.compiler.exe , runscripthelper.exe , makecab.exe , forfiles.exe , control.exe , msbuild.exe , register-cimprovider.exe , ie4uinit.exe , sc.exe , bash.exe , hh.exe , jsc.exe , scriptrunner.exe , odbcconf.exe , extexport.exe , msdt.exe , diskshadow.exe , extrac32.exe , eventvwr.exe , mavinject.exe , regasm.exe , gpscript.exe , rundll32.exe , regsvr32.exe , regedit.exe , msiexec.exe , presentationhost.exe , wmic.exe , runonce.exe , syncappvpublishingserver.exe , verclsid.exe , infdefaultinstall.exe , expand.exe , installutil.exe , wab.exe , dnscmd.exe , at.exe , pcalua.exe , msconfig.exe , powershell.exe , powershell_ise.exe , python.exe , certutil.exe , cmstp.exe , wscript.exe , cscript.exe , perl.exe , ruby.exe AND cgo name != amazonassistantservice.exe AND venm.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • NTLM Credential dumping via RpcPing.exe Medium Credential Access

    RpcPing.exe can be used to gain network NTLM hash for offline cracking.

    Indicator:

    Process action type = execution AND target process cmd = *-u *NTLM* , *-u *10* AND target process name = rpcping.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Nagios enumeration Low Credential Access

    A Nagios XI database may be enumerated for the credentials of the hosts monitored.

    Indicator:

    Process action type = execution AND target process cmd =~ mysql.*nagios\.nagios_(hosts|services|commands)

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netrc file enumeration Informational Credential Access

    Enumeration commands such as test and cat were executed on .netrc file paths that contain credentials.

    Indicator:

    Process action type = execution AND target process cmd = *test*.netrc* , *cat*.netrc* Host host os = linux

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Ntdsutil.exe accessing ntds.dit file High Credential Access

    Attackers may attempt to dump ntds.dit, which stores all Active Directory account information, to later extract passwords and hashes from it.

    Indicator:

    File action type = all AND file name = ntds.dit Process initiated by = ntdsutil.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Password-related Mozilla files were read by a non-Mozilla process Informational Credential Access

    Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

    Indicator:

    File file path = *\mozilla\firefox\* , *\netgate technologies\blackhawk\* , *\8pecxstudios\cyberfox\* , *\comodo\icedragon\* , *\k-meleon\* , *\mozilla\icecat\* AND file name = *.sqlite , *.db , *.json AND action type = read Process initiated by != firefox.exe AND blackhawk.exe AND cyberfox.exe AND icedragon.exe AND k-meleon.exe AND icecat

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Pluggable Authentication Modules Access Informational Credential Access

    Access to Pluggable Authentication Modules.

    Indicator:

    Process action type = execution AND target process name = vi , vim , nano AND target process cmd =~ .*/etc/pam[.]d/.+

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Modify Authentication Process: Pluggable Authentication Modules (T1556.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Pluggable Authentication Modules Modification Informational Credential Access

    Modification of Pluggable Authentication Modules.

    Indicator:

    File action type = write , delete , rename AND file path =~ ^/private/etc/pam[.]d/.*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Modify Authentication Process: Pluggable Authentication Modules (T1556.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible LSASS memory dump High Credential Access

    Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump.

    Indicator:

    Process action type = execution AND target process cmd = *-ma lsass.exe*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping: LSASS Memory (T1003.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Potential Network Sniffing Informational Credential Access

    Network sniffing related processes were detected.

    Indicator:

    Process action type = execution AND target process name = wireshark , tcpdump

    ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)
    ATT&CK techniques: Network Sniffing (T1040)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell runs with known Mimikatz arguments Medium Collection

    These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool.

    Indicator:

    Process action type = execution AND target process cmd = *privilege::* , *sekurlsa::* , *kerberos::* , *crypto::* , *vault::* , *token::* , *lsadump::* , *-dumpcr* , *-dumpce* AND target process name = powershell.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Reading .ssh files Informational Credential Access

    Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers.

    Indicator:

    Process action type = execution AND target process cmd = * .ssh , * .ssh * , * .ssh/* , */.ssh * , */.ssh/* AND target process name = cat , grep AND target process cmd != *grep -c* Process initiated by != ssh-copy-id AND rkhunter AND cgo name != nessus-service AND sshd AND electron AND sshd-keygen-wrapper AND ir_agent AND bbedit

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Registry credentials extraction Informational Credential Access

    Attackers may extract credentials from the Registry using system commands.

    Indicator:

    Process action type = execution AND target process cmd = * query* password* AND target process name = reg.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials in Registry (T1552.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SSH key pair discovery Informational Credential Access

    Attackers may look for SSH key pairs using the find command.

    Indicator:

    Process action type = execution AND target process name = find , cat AND target process cmd =~ .*(id_dsa|id_rsa|[.]key|[.]pgp|[.]gpg|[.]ppk|[.]p12|[.]pem|[.]pfx|[.]cer|[.]p7b|[.]asc).*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    File action type = read , rename , delete , write AND file name = .zsh_history , .bash_history , .sh_history

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    Process action type = execution AND target process name = cat , nano , vim AND target process cmd =~ .*(?:zsh_history|bash_history|sh_history).*

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell history access Informational Credential Access

    Attackers may search historical commands for credentials and information gathering.

    Indicator:

    Process action type = execution AND target process name = cat , grep AND target process cmd =~ .*\.(ba|z|fi|tc|c|k)?sh_history* Host host os = linux , macos

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Shell History (T1552.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious debug file created in a temporary folder High Credential Access

    SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin.

    Indicator:

    File file path =~ \\temp\\debug[0-9]*\.bin AND action type = create

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process accessed a Thunderbird Mail profiles folder Informational Credential Access

    An attacker may access the Thunderbird Mail profiles folder to extract users' credentials.

    Indicator:

    File action type = all AND file path = *\appdata\*thunderbird\profile* Process initiator signature = Unsigned , cgo signature = Unsigned , os parent signature = Unsigned AND initiator path != *Program Files* AND cgo path != *Program Files* AND os parent path != *Program Files* Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores (T1555)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process accessed a credential locker file Informational Credential Access

    The credential manager stores credentials for logging in to websites, applications and devices in encrypted Windows Vault Credential Files which can be accessed and decrypted by an attacker.

    Indicator:

    File action type = all AND file path = *.vcrd , *policy.vpol Process initiator signature = Unsigned , cgo signature = Unsigned , os parent signature = Unsigned Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Windows Credential Manager (T1555.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process reads Chromium credentials file Informational Credential Access

    Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

    Indicator:

    File file path = *\users\*\appdata\local\7star\7star\user data\* , *\users\*\appdata\local\amigo\user data\* , *\users\*\appdata\local\bravesoftware\brave-browser\user data\* , *\users\*\appdata\local\centbrowser\user data\* , *\users\*\appdata\local\chedot\user data\* , *\users\*\appdata\local\google chrome sxs\user data\* , *\users\*\appdata\local\chromium\user data\* , *\users\*\appdata\local\coccoc\browser\user data\* , *\users\*\appdata\local\elements browser\user data\* , *\users\*\appdata\local\epic privacy browser\user data\* , *\users\*\appdata\local\google\chrome\user data\* , *\users\*\appdata\local\kometa\user data\* , *\users\*\appdata\local\orbitum\user data\* , *\users\*\appdata\local\sputnik\sputnik\user data\* , *\users\*\appdata\local\torch\user data\* , *\users\*\appdata\local\ucozmedia\uran\user data\* , *\users\*\appdata\local\vivaldi\user data\* , *\users\*\appdata\local\yandex\yandexbrowser\user data\* , *\users\*\appdata\local\microsoft\edge\user data\* AND file name = *login data AND action type = read Process initiated by != chrome.exe AND chromedriver.exe AND amigo.exe AND brave.exe AND centbrowser.exe AND chedot.exe AND browser.exe AND epic.exe AND kometa.exe AND orbitum.exe AND torch.exe AND uran.exe AND vivaldi.exe AND msedge.exe AND cgo name != svchost.exe AND system AND cgo signature = Unsigned , Invalid Signature AND initiator signature = Unsigned , Invalid Signature Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WMI access to shadow copy interface Informational Credential Access

    An attacker may be trying to modify and/or delete shadow copies via WMI for disabling system backups or extracting NTDS.dit.

    Indicator:

    Process action type = execution AND target process cmd = *win32_shadowcopy*

    ATT&CK tactics: Credential Access (TA0006) Impact (TA0040)
    ATT&CK techniques: OS Credential Dumping (T1003) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Web browser cookie and credential access Informational Credential Access

    Detect attempt to acquire cookies or credentials from a Safari browser.

    Indicator:

    Process action type = execution AND target process cmd =~ .*(Cookies.binarycookies|[/]Safari[/]LocalStorage[/]).* AND target process name = grep

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WinPmem Forensics Tool Informational Collection XQL

    The WinPmem Forensics Tool has been run.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"AND":[{"LEFT":"$action_process_signature_vendor","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_signature_product","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"winpmem.exe","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) Automated Collection (T1119)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17